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ODP-81-421 
31 March 198] 


MEMORANDUM FOR: Director of Information Services 


THROUGH : Director of Data Processing 


FROM 
Security Officer, ODP 


SUBJECT : Application of Automatic Data Processing 
Systems to Information Security 
REFERENCE : OIS Memo, OIS 81-249/1 


dated 13 March 1981 


1. The Office of Data Processing provides and develops 
software applications for Agency users who establish program 
requirements. for security of information. ODP also provides 
physical and systems security for protecting access to the 
hardware, developing, and installing software security features 


= 


ae 


and foremost by restricting access to the systems by operating in 


a "Systems High Mode." 


2. It would be more appropriate for the users responsible 
for the creating, accountability and disposal of classified 
National Security Information to comment on the results of the 
use of ADP Systems in support of their information security 
program. 


3, On 26 March 1981, Ld) (OFS, stated that 
he was advised by the Information System Security Group/OS that 
the Chief of that group would supply information for the GSA 
inquiry and was in agreement with the above ODP response. 
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MEMORANDUM FOR: Director of Data Processing 
Director of Security 


FROM: Thomas H. White 
Director of Information Services 


SUBJECT: Application of Automatic Data Processing Systems to 
Information Security 


1. The attached letter from the Director of the Information Security 
Oversight Office (ISOO) directed to me requests Agency support in a study 
ISOO is conducting on the application of automatic data processing (ADP) 
systems to information security. The Office of Information Services does 
not have the information available to complete the questionnaire included, 
nor do we know your feelings as to whether or not the Agency desires to 
support this study. 


2. I would appreciate it if you would review the attached letter and 
the survey questions, supplying any information you feel appropriate. If 
you feel it inappropriate for the Agency to participate in the study, please 
let me know so that I may so advise the Director of ISOO. In either case, 
may I have you response by 27 March so that I may reply prior to his 
31 March deadline. 


STAT 


Attachment 
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Mr. Thomas H. White 

Director of Information Services 
Central Intelligence Agency 
Washington, DC 20505 


Dear Tom: 


‘The Information Security Oversight Office (ISOO) is conducting a preliminary study on 
the application of automated data processing (ADP) systems to information security. 
The objective is to study the present day uses of ADP technology as it relates to the 
ereation, accountability, and disposal of classified national security information and to 
cetermine if and/or how it can be applied on a government-wide basis to enhance the 
information security programs in the various agencies. 


To assist in attaining our objectives in this study, IS00 has prepared a list of survey 
questions. Sinee your agency is known to use ADP systems as support in some of your 
information security programs, a copy of the survey questions is enclosed. 

1 ask your voluntary support in this matter and urge you to answer and return to ISOO the 
ehelosed survey questions by March 31, 1981 At some later date we may expand our study 
to include an overview of computer systems in the agencies. If so, this will be handled 
through personal interviews. 


Please direct any questions or comments to me or Jane Payne. We may be reached at 
633-6830, ‘ 


Sincerely, 


STEVEN GARFINKEL 
Director 


Finelosure 
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TS00 SURVEY 


USE OF ADP EQUIPMENT/SYSTEMS * 
IN INFORMATION SECURITY PROCRAMS 


AGENCY: 
ACTIVITY, OFFICE, DIVISION: 
NAME AND TETLE OF RESPONDER: . | 


DATE: 


*NOTE: FOR THE PURPOSE OF THIS STUDY, ADP EGUIPMENT/SYSTEMS DOES NOT INCLUDE WORD 
PROCESSING EQUIPMENT. 
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1. Wien did you start using ADP computer 
equipment in the management of your 
information security program? 
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>, How did you determine the need for 
computerization in your information 
security program? 


te 


3. Did you have any difficulties in 
getting authorization for use of 
computer systems? What were the 
major difficulties? 
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4. What aspects of the information security 

program are being supported by ADP systems? 

(Qrief explanation) 

a. Control system for accountable classified material? 

b. Inventories? Top Secret? Secret? Confidential? 

ce. Personnel security clearances? 

d. Control of passes? 

e. Mandatory review for declassification? 

f, Systematic review for declassification? 

uv. Other declassification programs? 

hy. FOIA requests involving classified information 

i. Other (specify) 
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5. Age reports generated as a result of ADP processing? 
What kinds? Are they used by other agencies? (If so, 
explain.) How frequently are they updated? 


) 
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6. Has the use of ADP systems in your information security 
program been evaluated for cost effectiveness? 
(IF so, explain.) 
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7. Is manual processing of data a practical 
alternative in times of ADP computer © 
system outages? 


I 


3. How many members of the security staff have had 
formal training in computer science? How many are 
qualified to operate a terminal to make inputs and 
retrieve information? 


» 
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9, What problems have you encountered in application of 
ADP to the information security program (management 
and operational)? 
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What benefits have you encountered in application of ADP 
to operation and management of the information security 
program, i.e. decreased costs, decreased personnel staff, 
improved controls, etc.? 


% tr 
ww 
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li. Would you recommend use of computers to agencies with 
limited information security programs? (Costs vs. benefits?) 


x 


If so, in what areas? 
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ROUTING AND RECORD SHEET 
SUBJECT: (Optional) 


Application of Automatic Data Processing Systems to Information Security 


FROM: EXTENSION | NO. 


Thomas H. White 


Director of Information Services 
1206 Ames Building 


DATE 


TO; (Officer designation, room number, and 
building) 


RECEIVED | FORWARDED 


OFFICER'S COMMENTS (Number each comment to show from whom 
INITIALS to whom. Draw a line across column after each comment.) 


1. p/ODP 


2D0105 Headquarters 


cre a 


FORM 61 0 USE_PREVIOUS 


1-79 EDITIONS 
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